Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
We have started evaluating "HTTPS lite" option as our legacy explicit proxy solution replacement and I stumbled across a challenge of flaky Trusted CA updates process.
I'm referring to these two SKs:
sk132812 - How to force an update to the HTTPS Trusted Root CA list
I have couple of questions.
Q1: where I could find info about latest available Trusted CA update? When it was released and the version itself. By some reverse engineering of two SKs above I can see that our management thinks that the latest version is 2.7 released 1st Dec 2020:
I'm not entirely sure if indeed it is the latest version as bunch of trusted Microsoft CAs are missing.
Q2: how can we interpret update status codes? "3" does not sound good to me as normally "0" or "1" would be success:
Q3: could Checkpoint publish "offline" version of updateFile.zip file in an SK for manual download in case automated way does not work. I.e. - we did not get any notification that there was a new version available until I manually fetched updateFile.zip file from management and loaded it manually using SmartDashboard
Q4: Bunch of well known CAs are still missing, see MS example below where we had to add them manually:
Just wondering if it would be smart to create some sort of collaboration so we as customers could provide feedback on "missing" CA so they get incorporated into official bundles faster? I just want to avoid constant manual chasing of trusted CAs from logs when sites cannot be categorised because root CA is not known to Checkpoint
Any other thoughts and suggestions are welcome if you have found a better way! I.e. using CCADB
Q1 - that's the problem Val - SmartDashboard did not show that 🙂 Even though it was downloaded and available on the disk after digging into it with CLI. Hence my rant about "flaky-ness"
you don't need to have: Microsoft Azure TLS Issuing CA 01
you have its parent see image,
if you suspect you have missing certificate, download it, go to its properties and look if you have a parent in its chain,
Good, you have the latest bundle, the certificate that are missing should not be there, you have its parents as shown in image.
You cannot have all the certificates in the world... so you have only the ones in the "top" to confirm all the rest.
A quick question do you use portable smart console or did you install it?
SmartConsole is installed, not portable.
If that cert was missing we were getting "Detect" logs that site could not be categorised as cert was not trusted, for example
That may happen before installing the last bundle,
Once you have "DigitCert Global root G2" the 'parent' in the image you don't have to install any of its descendants, this is how it works (https://knowledge.digicert.com/solution/SO16297.html#:~:text=What%20is%20a%20Certificate%20Chain,and....).
Latest CA's currently are valid from January 15th, 2021 in v2.8.
On an MDS you would have to change into the specific mdsenv first and then go to the relevant TRUSTED_CA directory. The SmartConsole notification about available updates doesn't sometimes work for me as well. I don't see any risk of updating manually through SmartConsole to 2.8 as SmartConsole does various checks before it's actually importing the CA's. As always you should do recent updates of your MDS in case anything goes wrong.
